Two vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version. They are fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. No fixed release exists for PHP 8.1 or earlier.

The impact on Apigee is limited to Drupal-based Apigee developer portals, which customers deploy and operate. Other Apigee products don't use PHP and aren't affected.

For instructions and more details, see the Apigee security bulletin.

On Saturday, October 17, 2026, Google received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordinate Certification Authority (CA) certificates, including those cross-signed by AAA Certificate Services. Consequently, these CA certificates are no longer trusted and are being revoked.

Although Google Cloud infrastructure remains uncompromised, the following Google Cloud and Firebase products, base images, and client SDKs are impacted:

• Google Cloud CLI
• Cloud Shell
• Container-Optimized OS
• Compute Engine
• Google Kubernetes Engine
• Vertex AI
• Colab Enterprise
• App Engine
• Cloud Run
• Cloud Run functions
• Cloud Functions for Firebase
• Firebase AppHosting
• Cloud SQL
• AlloyDB
• Cloud Firestore
• Firebase App Distribution
• Cloud Monitoring
• Confidential Space
• Google Distributed Cloud

What should I do?

Google Cloud is actively managing this issue across our infrastructure and platform services, and Google Cloud infrastructure has not been breached. Security telemetry shows no evidence of exploitation against Google Cloud workloads, and proactive mitigations are in place across Google-managed environments to block and distrust the affected certificate authority certificates.

For environments and dependencies that you manage directly, take the following actions:

• Operating Systems & Self-Managed Environments: If you manage operating systems or custom container images on Compute Engine, Google Kubernetes Engine (GKE), or Cloud Run, update the trust store via your operating system vendor to revoke trust in the compromised eMudhra (emSign) and AAA Certificate Services certificates:
  • Red Hat Enterprise Linux (RHEL): Follow RHSB-2026-012.
  • Debian: Update to the latest ca-certificates package (Bug 1151446).
  • Ubuntu: Follow USN-8944-1.
  • Windows: Install the latest Windows updates.
  • Container-Optimized OS (COS): Upgrade or restart nodes to pick up current COS milestone releases, or apply the cos_ca_cert_mitigation tool.
• Google Cloud CLI: Update to the latest gcloud CLI release to ensure bundled dependencies include updated certificate stores.
• Service-Specific Guidance: For managed Google Cloud and Firebase services, such as Google Kubernetes Engine, Serverless runtimes, Managed Databases, Cloud Firestore, Firebase App Distribution, and Confidential Space, Google Cloud is rolling out updates across managed fleets, and service-specific details, release notes, and customer communications will be published through the respective product documentation and official support channels as they become available. Please review individual service documentation for instructions tailored to your deployments. For GKE details and patch versions, see the GKE security bulletin.

If you have any questions or require assistance, please contact Google Cloud Support and reference issue #576444463.

What vulnerabilities are being addressed?

The private keys for eight eMudhra (emSign) subordinate Certification Authority (CA) certificates were generated using insufficient cryptographic randomness (weak entropy).

This weakness allows a remote attacker with network access to reconstruct private keys, forge trusted TLS certificates, and perform Man-in-the-Middle (MitM) interception against TLS clients, containers, or SDKs that have not yet removed trust in these subordinate CAs.

• CVE-2026-111943
• Red Hat (RHSB-2026-012)
• Ubuntu (USN-8944-1)
• Debian (DSA-6572-1 / Bug 1151446)

Two remote code execution vulnerabilities were found in the open-source PHP language. While Google Cloud itself is not vulnerable, users of this language running on Google Cloud may be vulnerable.

The following language versions are affected by this vulnerability:

• All PHP versions between 5.4 and 8.5

The following framework versions include fixes for this vulnerability:

• PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

What should I do?

Customers should take immediate action to protect their workloads by redeploying their workloads with updated dependencies. Some workloads may be automatically patched and updated to the latest PHP if they are on Google App Engine Standard or one of Cloud Run, Cloud Run functions with automatic updates enabled. See the blog post for more information.

How can Google help?

Customers using Artifact Analysis receive notifications of these vulnerabilities on both new and existing artifacts to help them identify at-risk workloads.

• CVE-2026-109618
• CVE-2026-109619

Security vulnerabilities were discovered in Istio and Envoy Proxy (ISTIO-SECURITY-2026-007).

For instructions and more details, see the Cloud Service Mesh security bulletin.

• GHSA-w44g-8m76-8gc5
• GHSA-7p2q-4xvg-vxc6
• GHSA-8vc2-jrm4-835w
• GHSA-47vj-9r25-wv5j

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27, 2026.

What should I do?

No customer action is required. This vulnerability was patched on August 27, 2026.

What vulnerabilities are being addressed?

An authenticated user could escalate privileges and impersonate a service account in the Google Cloud project.

A Denial-of-Service (DoS) vulnerability was discovered in Envoy Proxy when an HTTP filter (such as ext_proc with route_cache_action: RETAIN) mutates the :path header after route selection on a route configured with prefix_rewrite.

For instructions and more details, see the Cloud Service Mesh security bulletin.

A Confused Deputy vulnerability was discovered in the Email Task component in Application Integration versions prior to June 30, 2026.

What should I do?

No customer action is required. This vulnerability was patched on June 30, 2026.

What vulnerabilities are being addressed?

An authenticated attacker could read and exfiltrate arbitrary Google-internal files using a crafted attachment path.

A Deserialization of Untrusted Data vulnerability was discovered in the JavaScript Task in Application Integration versions prior to June 28, 2026.

What should I do?

No customer action is required. This vulnerability was patched on June 28, 2026.

What vulnerabilities are being addressed?

An authenticated user with standard permissions could use a specially crafted script to run arbitrary code on the shared production servers.

An Incorrect Authorization vulnerability was discovered in the task configuration in Application Integration versions prior to June 17, 2026.

What should I do?

No customer action is required. This vulnerability was patched on June 17, 2026.

What vulnerabilities are being addressed?

An authenticated user could use an internal-only task type to execute arbitrary internal RPCs from the Google-internal production network under a privileged identity.

An Improper Privilege Management vulnerability in Google Security Operations SOAR was patched with version 6.3.85, and no customer action is needed. The vulnerability allowed an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header.

What should I do?

No customer action is required. All customers have been automatically upgraded to the fixed version: 6.3.85 or higher.

Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database.

What should I do?

For instructions and more details, see the Cluster Toolkit security bulletin.

• CVE-2026-65107
• CVE-2026-65108
• CVE-2026-65109
• CVE-2026-65138
• CVE-2026-65139
• CVE-2026-65140
• CVE-2026-65165
• CVE-2026-65168

A security vulnerability (GHSA-p7v4-vr35-mj6f, CVE assignment pending) in containerd's CRI implementation allows a container restored from an untrusted checkpoint through the CreateContainer API to bypass the destination security context and execute with elevated privileges.

GKE clusters are not vulnerable by default. GKE node images do not include the criu tool.

What should I do?

No immediate customer action is required for default clusters. If you install custom runtime software or node tools on your nodes that include the criu binary, refer to the security bulletin for recommended actions.

What vulnerabilities are being addressed?

For more information, see the GKE security bulletin.

2026-09-08 Update: Added link to the Cluster Toolkit security bulletin.

A security flaw in the Slurm sbcast tool (CVE-2026-65107) lets shared library files bypass security checks and can crash nodes in your cluster.

What should I do?

For instructions and more details, see the following bulletins:

• Cluster Toolkit security bulletin
• Cluster Director security bulletin

A Missing Authorization vulnerability was discovered in the HTTP Connector in Integration Connectors versions prior to December 11, 2025.

What should I do?

No customer action is required. This vulnerability was patched on December 11, 2025.

What vulnerabilities are being addressed?

An authenticated attacker could use an unauthorized service account attachment to escalate privileges and take over a Google Cloud project.

A missing project permission check in GKE Multi-Cloud (CreateAttachedCluster, CreateAwsCluster, CreateAzureCluster) APIs allowed an attacker to register an attached cluster into an arbitrary target project's Workload Identity Federation for GKE. This registration allowed unauthorized creation of Workload Identity tokens and impersonation of Kubernetes Service Accounts that have bindings in the target project through the Workload Identity Federation for GKE configuration.

For instructions and more details, see the GKE security bulletin

A series of vulnerabilities were discovered in Envoy Proxy.

For instructions and more details, see the Cloud Service Mesh security bulletin.

• CVE-2026-73513
• CVE-2026-73552
• CVE-2026-73512
• CVE-2026-73547
• CVE-2026-73549
• CVE-2026-50572
• CVE-2026-73546
• CVE-2026-48521
• CVE-2026-73551
• CVE-2026-73511
• CVE-2026-73548
• CVE-2026-73550
• CVE-2026-73553

An Improper Input Validation vulnerability was discovered in the JDBC driver in BigQuery Data Transfer Service versions prior to May 1, 2026.

What should I do?

No customer action is required. This vulnerability was patched on May 1, 2026.

What vulnerabilities are being addressed?

An authenticated attacker could use crafted JDBC connection string parameters to achieve remote code execution in the connector container and escalate privileges in the tenant project.

A critical unauthenticated Remote Code Execution (RCE) vulnerability exists in Next.js and libheif when processing malicious image files. Google Cloud infrastructure is not directly vulnerable, but customer workloads running Next.js on Google Cloud (e.g., Cloud Run, GKE, App Engine) may be affected.

What should I do?

Google Cloud backend services are not directly impacted, and no action is required to secure the underlying Google Cloud infrastructure. However, customers hosting Next.js applications on Google Cloud must take immediate action to secure their own workloads. We recommend that you manually upgrade your Next.js deployments to one of the following versions (or later) in your package.json: 

• 16.3.3
• 15.5.24

What vulnerabilities are being addressed?

The vulnerabilities, GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497, allow an attacker to execute arbitrary code within the context of the application by supplying a crafted image file during Next.js image optimization. This issue occurs due to how the underlying libheif library processes clean aperture boxes in HEIF/AVIF images.

A vulnerability (CVE-2026-6726, also known as TCGVRT0010) has been identified in the Trusted Computing Group's TPM 2.0 reference implementation code, affecting all published revisions of the code (v1.16, v1.38, v1.59, v1.83, v184).

What should I do?

No customer action is required. Google will proactively update your systems during your standard and planned maintenance windows.

What vulnerabilities are being addressed?

For more information, see the Compute Engine security bulletin.

Google is aware of several security vulnerabilities affecting Intel® Trust Domain Extensions (TDX) firmware that can compromise confidential guest integrity. These vulnerabilities could allow a privileged host adversary to bypass attestation checks, access restricted registers, or decrypt normally protected guest memory.

What Google products are affected?

All Confidential VM instances relying on Intel TDX technology.

What should I do?

Google has proactively applied these firmware upgrades to our server fleet to mitigate these vulnerabilities. No action is required for customers that did not receive a separate direct advisory to upgrade.

For more information, see Intel's PSIRT technical advisories: INTEL-TA-01404, INTEL-TA-01428, INTEL-TA-01419, INTEL-TA-01439, INTEL-TA-01442, INTEL-TA-01436.

• CVE-2025-31938
• CVE-2025-35973
• CVE-2025-31356
• CVE-2026-20898
• CVE-2026-20713
• CVE-2026-20901
• CVE-2026-20885
• CVE-2026-20705
• CVE-2026-20775

A security vulnerability has been identified in the Kernel-based Virtual Machine (KVM) x86 shadow Memory Management Unit (MMU) impacting both Intel and AMD platforms.

What should I do?

No action is required for managed Compute Engine virtual machines. Because the vulnerability resides in the host hypervisor, Google has mitigated all affected Intel and AMD-based host infrastructure transparently via live patching without requiring customer VM downtime, reboots, or manual upgrades.

If you operate self-managed virtualized environments or custom host hypervisors outside standard managed Compute Engine infrastructure, you should ensure your host Linux kernel is updated with the upstream patch as soon as it is made available by your operating system distribution vendor.

What vulnerabilities are being addressed?

This is a KVM vulnerability that could lead to a VM escape. There has been no active exploitation observed, and this is a proactive patching effort.

The following vulnerabilities have been discovered in containerd (the GDC container runtime). These vulnerabilities allow attackers with permissions to create Pods to bypass Kubernetes security boundaries and perform host compromise, cache poisoning, and denial of service. While these vulnerabilities are critical in the context of containerd, the requirement to have cluster privileges to create Pods to exploit them means they are considered High according to GDC (software only) vulnerability classification.

• CVE-2026-50195 (Critical): containerd's CRI checkpoint import process fails to validate image references. An attacker with permissions to create Pods can use a crafted checkpoint image to poison the node's local image cache, causing other pods to use a malicious image.
• CVE-2026-53488 (Critical): CRI plugin propagates labels from an image config to a container without validation. This may result in executing an arbitrary command on the host.
• CVE-2026-53492 (Critical): CRI implementation improperly trusts Container Device Interface (CDI) annotations during container restoration. This allows an attacker to inject arbitrary CDI configurations (such as host mounts and device nodes) into restored containers, bypassing resource allocation and device plugin enforcement.
• CVE-2026-53489 (High): CRI plugin restores container.log without validating a symlinked path, allowing an attacker to read arbitrary host files via kubectl logs.
• CVE-2026-47262 (Moderate): A vulnerability in containerd allows a maliciously crafted image to cause memory exhaustion (DoS) of the containerd process.

What should I do?

For GDC software only on bare metal, the following patches will contain fixes for the vulnerabilities issue:

• 1.34.800
• 1.33.1100

For GDC software only on VMware, the following patches will contain fixes for the vulnerabilities:

• 1.34.800
• 1.33.1200

Per advisory VMSA-2026-0006, multiple vulnerabilities in VMware ESXi, and vCenter were privately reported to Broadcom. We are in the process of applying the necessary patches supplied by Broadcom. There are no known workarounds for these reported vulnerabilities.

Once patched, your VMware Engine deployments should be running vCenter and ESXi 8.0 U3k.

What should I do?

Google recommends customers to monitor their workloads on VMware Engine for any unusual activities.

• VMSA-2026-0006
• CVE-2026-59309
• CVE-2026-59310
• CVE-2026-47876
• CVE-2026-41703
• CVE-2026-41709

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in Google Cloud Looker. An attacker could craft a malicious URL that, when opened by an authenticated administrator, would allow the attacker to execute arbitrary scripts on their behalf and potentially compromise the administrator account.

What should I do?

For Looker-hosted instances, no action is required.

For self-hosted Looker instances, update your Looker instances as soon as possible. This vulnerability has been patched in all supported versions of Looker for self-hosted instances. The following versions have all been updated to fix this vulnerability:

• Looker 26.8.7 and all later versions
• Looker 26.6.28+
• Looker 26.4.36+
• Looker 26.2.47+
• Looker 26.0.66+
• Looker 25.18.68+
• Looker 25.12.65+
• Looker 25.6.103+

What vulnerabilities are being addressed?

For more information, see CVE-2026-15810.

A privilege escalation vulnerability was addressed in Developer Connect. Previously, for GitLab Enterprise and Bitbucket Data Center connections, when Secret Manager secrets were retrieved, permissions were checked against the Developer Connect service agent (P4SA) credentials only. Developer Connect now validates that both the calling principal and the P4SA have the required permissions on the referenced secrets.

For instructions and more details, see the Developer Connect security bulletin.

A Missing Authorization vulnerability was discovered in repositories in BigQuery, Dataform, and Colab Enterprise.

What should I do?

No customer action is required. Google has already applied mitigations to all impacted products and services.

What vulnerabilities are being addressed?

During repository creation, an authenticated attacker could potentially escalate their permissions and perform cross-tenant repository takeover.

A virtualization vulnerability has been identified in the KVM x86 shadow paging and nested virtualization configurations. Because an attacker operating a virtual machine with nested virtualization could escape hypervisor boundary isolation to compromise the underlying physical host, any x86 virtual machine (whether nested or non-nested) hosted on an Intel-based server supporting nested virtualization is potentially exposed.

What should I do?

Google is deploying live hypervisor hotpatches across all managed Compute Engine host servers globally. No action is required for managed Compute Engine virtual machines or Google Kubernetes Engine clusters. Because remediation is performed transparently at the physical host hypervisor level, customer VM downtime, reboots, or manual upgrades are not required.

Customers operating self-managed virtualized environments or custom host hypervisors outside standard managed Compute Engine infrastructure should ensure their host Linux kernel is updated with the upstream patch as soon as it is made available by their operating system vendor.

What vulnerabilities are being addressed?

The vulnerability (CVE-2026-53359) exploits a use-after-free error in the x86 shadow paging and nested page table translation routines. Google has observed no evidence of active customer exploitation in production environments. Live patching and host-level monitoring have been implemented globally to mitigate risk and detect exploit attempts.

A vulnerability was detected in Envoy Proxy where blocked QPACK decoding can cause a Denial-of-Service Attack against the HTTP/3 stack.

For instructions and more details, see the Cloud Service Mesh security bulletin.

A vulnerability was detected in Application Integration's JavaScript task, which was using the Rhino JavaScript engine. This only impacted tasks published before January 2025.

For details and instructions, see the Application Integration security bulletin.

A vulnerability was found in Firebase Studio where the GetSignedGcsUrl RPC allowed authenticated users to list buckets and download deployment source code of other tenants.

No action is required to mitigate this vulnerability as the fix has been deployed to the backend service.

As a precautionary measure, users who stored sensitive information, such as API keys (for example, GEMINI_API_KEY), within their Firebase Studio workspace may choose to rotate these keys. For instructions, see the Firebase Studio troubleshooting guide.